Apache和Nginx开启Https，apachenginxhttps

文章由LinuxBoy分享于2019-09-10 06:09:12热评（388）

Apache和Nginx开启Https，apachenginxhttps

1.安装openssl

[root@c6 ~]# yum install -y openssl openssl-devel

___________________________________________________________ yum安装方式

http://www.openssl.org/source/ #下载openssl

[root@Web_server src]# tar xf openssl-1.0.1s.tar.gz

[root@Web_server src]# cd openssl-1.0.1s

[root@Web_server openssl-1.0.1s]# ./config

[root@Web_server openssl-1.0.1s]# make && make install

------------------------------------源码安装方式

安装apache

[root@Web_server src]# wget http://mirrors.cnnic.cn/apache/httpd/httpd-2.2.31.tar.gz

[root@Web_server src]# tar xvf httpd-2.2.31.tar.gz

[root@Web_server src]#cd httpd-2.2.31

[root@Web_server httpd-2.2.31]#./configure --prefix=/usr/local/apache2 --with-included-apr --enable-so --enable-deflate=shared --enable-expires=shared --enable-rewrite=shared --with-pcre --enable-ssl=shared --with-ssl=/usr/local/ssl #此处选择动态模式，--enable-ssl=static --with-ssl=/usr/local/ssl选择静态

------------------------------------添加扩展模块方式

[root@Web_server openssl-1.0.1s]# cd /usr/local/src/httpd-2.2.31/modules/ssl #务必进入httpd源码目录

[root@Web_server ssl]# /usr/local/apache2/bin/apxs -i -c -a -D HAVE_OPENSSL=1 -I

/usr/lib/openssl/engines/lib -lcrypto -lssl -ldl *.c

错误一、error "Unrecognized SSL Toolkit!、declaration for parameter 'XXXXXX' but no such parameter

解决：添加-D HAVE_OPENSSL=1

错误二、undefined symbol: ssl_cmd_SSLMutex

解决：apxs编译追加模块成功，但是apache启动失败。出现这个错误后，我把运行apxs时指定mod_ssl.c改成*.c 。和添加mod_deflate不一样，ssl中包含多个源代码文件

错误三、undefined symbol: X509_INFO_free

解决：由于静态连接了 openssl的库造成的(默认），解决办法是添加-lcrypto -lssl -ldl参数

2.创建证书

■ 创建私钥

___________________________________________________________

[root@Web_server modules]# cd /usr/local/ssl/bin/

[root@Web_server bin]# openssl genrsa -out server.key 2048

[root@Web_server bin]# cp server.key /usr/local/apache2/conf/ssl.key

■ 生成证书请求（CSR）文件

___________________________________________________________

[root@Web_server bin]# openssl req -new -key server.key -out certreq.csr

Country Name (2 letter code) [XX]:cn #所在国家的ISO标准代号，中国为CN

State or Province Name (full name) []:zj #单位所在地省/自治区/直辖市

Locality Name (eg, city) [Default City]:zs #单位所在地的市/县/区

Organization Name (eg, company) [Default Company Ltd]:dx #单位/机构/企业合法的名称

Organizational Unit Name (eg, section) []:zwy #部门名称

Common Name (eg, your name or your server's hostname) []:zwy #此项必须与访问提供SSL服务的服务器时所应用的域名完全匹配

Email Address []: #邮件地址，不必输入，直接回车跳过

"extra"attributes #以下信息不必输入，回车跳过直到命令执行完毕

[root@c6 conf]# cp server.key server.key.ori

[root@c6 conf]# openssl rsa -in server.key.ori -out server.key

writing RSA key

[root@c6 conf]# openssl x509 -req -days 365 -in certreq.csr -signkey server.key -out server.crt

Signature ok

subject=/C=CN/ST=ZJ/L=ZS/O=DX/OU=ZWY/CN=ZWY/emailAddress=szk5043@foxmail.com

Getting Private key

3. Apache配置

___________________________________________________________

[root@Web_server ~]# vim /usr/local/apache2/conf/httpd.conf

Include conf/extra/httpd-ssl.conf

#取消前面注释

[root@Web_server ~]# vim /usr/local/apache2/conf/extra/httpd-vhosts.conf

RewriteEngine on

RewriteCond %{SERVER_PORT} !^443$

RewriteRule ^/?(.*)$ https://%{SERVER_NAME}/$1 [L,R]

#在需要开启的虚拟主机配置文件中，加上http自动重定向为https

[root@Web_server ~]# mv /usr/local/apache2/conf/extra/httpd-ssl.conf

/usr/local/apache2/conf/extra/httpd-ssl.conf.bak #备份默认配置文件

[root@Web_server ~]# > /usr/local/apache2/conf/extra/httpd-ssl.conf

[root@c6 ~]# vim /usr/local/apache2/conf/extra/httpd-ssl.conf

LoadModule ssl_module modules/mod_ssl.so

Listen 443

SSLPassPhraseDialog builtin

SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)

SSLSessionCacheTimeout 300

SSLMutex default

SSLRandomSeed startup file:/dev/urandom 256

SSLRandomSeed connect builtin

#SSLCryptoDevice builtin

SSLProtocol all -SSLv2 -SSLv3

SSLHonorCipherOrder on

SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:!RC4:

DocumentRoot "/data/www"

ServerName www.szk.com:443

ErrorLog "logs/dummy-host.example.com-error_log"

CustomLog "logs/dummy-host.example.com-access_log" common

SSLEngine on

SSLCertificateFile /usr/local/apache2/conf/server.crt

SSLCertificateKeyFile /usr/local/apache2/conf/server.key

#SSLCertificateChainFile /usr/local/apache/conf/ssl.crt/intermediatebundle.crt

</IfModule>

</VirtualHost>

错误：curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

解决：把443的VirtualHost 放到80的VirtualHost 前面；80 部分 NameVirtualHost *443部分NameVirtualHost *:443

1.SSL模块

nginx的https协议需要ssl模块的支持，我们在编译nginx时使用–with-http_ssl_module参数加入SSL模块。还需要服务器私钥，服务器证书，如果是公司对外环境，这个证书需要购买第三方的权威证书，否则用户体验得不到保障

2.检查Nginx的SSL模块是否安装

[root@c6 ~]# /usr/local/nginx/sbin/nginx -V

nginx version: nginx/1.6.2

built by gcc 4.4.7 20120313 (Red Hat 4.4.7-17) (GCC)

TLS SNI support enabled

configure arguments: --prefix=/usr/local/nginx --with-pcre --with-http_ssl_module --with-http_stub_status_module

3.准备私钥和证书

3.1创建服务器私钥

[root@c6 ~]# cd /usr/local/nginx/conf/

[root@c6 conf]# mkdir key

[root@c6 conf]# cd key

[root@c6 key]# openssl genrsa -des3 -out server.key 1024

Generating RSA private key, 1024 bit long modulus

..................++++++

..............++++++

e is 65537 (0x10001)

Enter pass phrase for server.key: ##输入一个密码

Verifying - Enter pass phrase for server.key: #再次输入

3.2签发证书

[root@c6 key]# openssl req -new -key server.key -out server.csr

Enter pass phrase for server.key:

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [XX]:CN

State or Province Name (full name) []:SH

Locality Name (eg, city) [Default City]:SH

Organization Name (eg, company) [Default Company Ltd]:YJS

Organizational Unit Name (eg, section) []:SA

Common Name (eg, your name or your server's hostname) []:Web

Email Address []:szk5043@foxmail.com

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:root

An optional company name []:root

3.3 删除服务器私钥口令

[root@c6 key]# cp server.key server.key.ori

[root@c6 key]# openssl rsa -in server.key.ori -out server.key

Enter pass phrase for server.key.ori:

writing RSA key

3.4生成使用签名请求证书和私钥生成自签证书

[root@c6 key]# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Signature ok

subject=/C=CN/ST=SH/L=SH/O=YJS/OU=SA/CN=Web/emailAddress=szk5043@foxmail.com

Getting Private key

3.5开启Nginx SSL

[root@c6 ~]# vim /usr/local/nginx/conf/vhosts/szk.conf

server {

server_name www.szk.com;

listen 80;

rewrite ^(.*) https://$server_name$1 permanent;

}

server {

listen 443;

server_name www.szk.com;

index index.html index.htm index.php;

root /data/www;

ssl on;

ssl_certificate key/server.crt;

ssl_certificate_key key/server.key;

location ~ \.php$ {

include fastcgi_params;

#fastcgi_pass unix:/tmp/php-fcgi.sock;

fastcgi_pass 127.0.0.1:9000;

fastcgi_index index.php;

fastcgi_param SCRIPT_FILENAME /data/www$fastcgi_script_name;

}

#把80端口的访问自动跳转到433端口

[root@c6 ~]# /etc/init.d/nginx restart

Stopping Nginx: [ OK ]

Starting Nginx: [ OK ]

[root@c6 ~]# netstat -tnlup | grep nginx

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1504/nginx

tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 1504/nginx

4.测试

默认情况下ssl模块并未被安装，如果要使用该模块则需要在编译时指定–with-http_ssl_module参数，安装模块依赖于OpenSSL库和一些引用文件，通常这些文件并不在同一个软件包中。通常这个文件名类似libssl-dev。

可以通过以下步骤生成一个简单的证书：

首先，进入你想创建证书和私钥的目录，例如：

cd /usr/local/nginx/conf

创建服务器私钥，命令会让你输入一个口令：

openssl genrsa -des3 -out server.key 1024

创建签名请求的证书（CSR）：

openssl req -new -key server.key -out server.csr

在加载SSL支持的Nginx并使用上述私钥时除去必须的口令：

cp server.key server.key.org

openssl rsa -in server.key.org -out server.key

配置nginx

最后标记证书使用上述私钥和CSR：

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

修改Nginx配置文件，让其包含新标记的证书和私钥：

server {

server_name YOUR_DOMAINNAME_HERE;

listen 443;

ssl on;

ssl_certificate /usr/local/nginx/conf/server.crt;

ssl_certificate_key /usr/local/nginx/conf/server.key;

}

重启nginx。

这样就可以通过以下方式访问：

https://YOUR_DOMAINNAME_HERE

另外还可以加入如下代码实现80端口重定向到443

server {

listen 80;

server_name ww.centos.bz;

rewrite ^(.*) https://$server_name$1 permanent;

}

(1) 生成私钥；

# (umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 4096)

(2) 生成自签证书；

# openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 365

-new：生成新证书签署请求；

-x509：生成自签格式证书，专用于创建私有CA时；

-key：生成请求时用到的私有文件路径；

-out：生成的请求文件路径；如果自签操作将直接生成签署过的证书；

-days：证书的有效时长，单位是day；

(3) 为CA提供所需的目录及文件；

# mkdir -pv /etc/pki/CA/{certs,crl,newcerts}

# touch /etc/pki/CA/{serial,index.txt}

# echo 01 > /etc/pki/CA/serial

此主机即是一台CA了。

(4)用到证书的主机(httpd主机)生成私钥；

# mkdir /etc/httpd/ssl

# cd /etc/httpd/ssl

# (umask 077; openssl genrsa -out /etc/httpd/ssl/httpd.key 2048)

(5) 生成证书签署请求

# openssl req -new -key /etc/httpd/ssl/httpd.key -out /etc/httpd/ssl/httpd.csr -days 365

(6) 在CA主机上签署证书；

# openssl ca -in /etc/httpd/ssl/httpd.csr -out /etc/pki/CA/certs/httpd.crt -days 365

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 1(0x2)

Validity

Not Before: Apr 10 15:45:54 2016 GMT

Not After : Apr 10 15:45:54 2017 GMT

Subject:

countryName = CN

stateOrProvinceName = beijing

organizationName = ops

organizationalUnitName = ops

commonName = ops.com

emailAddress = admin@ops.com

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

08:A3:DD:98:D3:E0:42:58:5E:B7:24:43:6C:3D:B1:D8:02:34:16:46

X509v3 Authority Key Identifier:

keyid:75:63:44:2C:46:80:2F:84:CE:EF:C6:F1:F2:E7:75:2E:EF:17:37:C2

Certificate is to be certified until Apr 10 15:45:54 2017 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

(7)查看证书中的信息：

# openssl x509 -in /etc/pki/CA/certs/httpd.crt -noout -serial -subject

推荐文章：

Apache和Nginx开启Https，apachenginxhttps